How to Test an IEC 60870-5-104 Connection
IEC 60870-5-104 (IEC-104) runs telecontrol messages between a master (SCADA, gateway) and an outstation (RTU, substation controller, plant controller) over TCP port 2404. Bringing a new link up is mostly about four questions. Does TCP connect? Does data transfer start? Does a general interrogation return the expected points? Do commands reach the right object? This guide walks through them in that order.
The pieces you need to know
| Term | What it is |
|---|---|
| APDU | One IEC-104 frame. Three formats: I (numbered data), S (acknowledgement only), U (control: STARTDT, STOPDT, TESTFR) |
| ASDU | The data unit inside an I-frame: type, cause, address and information objects |
| Common Address (CA) | The ASDU address of the station, set on both sides and required to match |
| IOA | Information Object Address: the “register number” of each point (3 bytes in IEC-104) |
| COT | Cause of Transmission: why this message was sent |
| Type ID | What the object is, for example a single point, a float measurement or a command |
Step 1: TCP on port 2404
Connect to the outstation’s IP on port 2404. If it fails:
- Firewall or VPN routing between you and the RTU
- The outstation only accepts connections from configured master IPs (very common)
- The outstation accepts only one master at a time and the production SCADA is already connected
Step 2: STARTDT
A TCP connection alone doesn’t start data flow. The master sends a STARTDT act U-frame, and the outstation replies with STARTDT con. No reply within the t1 timeout (15 s by default) and the master closes the connection.
When the link is idle, either side sends TESTFR act after t3 (20 s by default), and the other must answer TESTFR con. A link that drops every 20–35 seconds usually has a TESTFR problem.
Default timers and window sizes:
| Parameter | Default | Meaning |
|---|---|---|
| t0 | 30 s | Connection establishment timeout |
| t1 | 15 s | Timeout for a sent frame to be acknowledged |
| t2 | 10 s | Acknowledge received I-frames at the latest after this (if no data to send) |
| t3 | 20 s | Send a test frame after this much idle time |
| k | 12 | Max unacknowledged I-frames the sender may have outstanding |
| w | 8 | Acknowledge at the latest after receiving this many I-frames |
Mismatched k/w or t1/t2 between two implementations causes disconnects under load, not in a quiet lab. Test with realistic data rates.
Step 3: General interrogation
Send C_IC_NA_1 (type 100) with qualifier QOI = 20 (station interrogation) to the outstation’s Common Address. A healthy sequence looks like this:
- Outstation: C_IC_NA_1 with COT 7 (activation confirmation)
- Outstation: all points, each with COT 20 (interrogated by station interrogation)
- Outstation: C_IC_NA_1 with COT 10 (activation termination)
If you get a negative confirmation or nothing at all, check the Common Address first. After a successful GI, the outstation sends changes spontaneously with COT 3.
Step 4: Check the points
Compare the GI response with the signal list (point list) agreed with the RTU vendor:
| Type ID | Name | Typical use |
|---|---|---|
| 1 (M_SP_NA_1) | Single point | Breaker alarm, status bit |
| 3 (M_DP_NA_1) | Double point | Breaker position (open / closed / intermediate / invalid) |
| 13 (M_ME_NC_1) | Measured value, short float | Power, voltage, current |
| 30, 31, 36 | Same with CP56Time2a time tag | Time-stamped events and measurements |
Check three things per point: the IOA matches the list, the type ID matches (a float listed as a scaled value will decode wrongly), and the quality bits are not flagging it invalid or not topical.
Step 5: Commands
Commands use their own type IDs:
| Type ID | Name | Use |
|---|---|---|
| 45 (C_SC_NA_1) | Single command | On/off |
| 46 (C_DC_NA_1) | Double command | Breaker open/close |
| 50 (C_SE_NC_1) | Set point, short float | Power limit, reactive power setpoint |
| 103 (C_CS_NA_1) | Clock synchronization | Set the outstation clock |
Many outstations require select-before-operate: send the command with the select bit, wait for the confirmation, then send the execute. A direct execute to a SBO-configured object is rejected with a negative confirmation (COT 7 with the negative bit set).
Test commands against a simulator or a disconnected object before trying live equipment.
Common failures and what they mean
| Symptom | Likely cause |
|---|---|
| TCP connects, then closes after ~15 s | No STARTDT con: wrong CA handling, or the outstation is waiting for a different master |
| Drops every ~20–35 s when idle | TESTFR not answered on one side |
| GI confirmed but no points | Points mapped to a different Common Address |
| Values look wrong by powers of ten | Normalized/scaled vs float type mismatch |
| Event times off by hours | One side sends local time, the other expects UTC |
| Works in lab, drops in production | k/w or t1/t2 mismatch under higher data rates |
Testing both directions
Two tools cover most commissioning work:
- A client (master) that connects to a real RTU, runs GI, shows live updates and sends commands
- A server (RTU simulator) that answers a real SCADA or gateway, so the master side can be proven before anyone drives to site
Ranaliz iOT Tester does both from one free desktop app for Windows and macOS. It also has a Modbus tester (TCP/UDP/RTU) and an MQTT client for the other half of the plant. If a gateway translates Modbus to IEC-104, test the Modbus side first. Modbus exception codes covers the usual errors.
FAQ
What port does IEC 104 use?
TCP 2404 by default. Some installations change it, so check the outstation configuration.
What is the difference between IEC 101 and IEC 104?
IEC 60870-5-101 runs over serial links, and IEC 60870-5-104 carries the same application layer over TCP/IP. Addressing sizes differ: IEC-104 normally uses a 2-byte Common Address and a 3-byte IOA.
Can I test IEC 104 without the real RTU?
Yes. Run an RTU simulator with the agreed point list and connect the master to it. Most mapping and command problems show up there first.
Sources
- IEC 60870-5-104 — Transmission protocols: network access for IEC 60870-5-101 using standard transport profiles
- IEC 60870-5-101 — Companion standard for basic telecontrol tasks (ASDU types and COT definitions)
